feat: enhance network management and lifecycle handling with improved egress setup and validation

tests/test_lifecycle_commands.py

@@ -385,7 +385,7 @@ class LifecyclePortTests(LifecycleTestCase):
         self.assertEqual(self.settings.state_path.read_bytes(), before)
         self.assertEqual(self.host.events, [])
 
-    def test_start_of_running_vm_repairs_policy_without_reboot_or_reprovision(self) -> None:
+    def test_start_of_running_vm_repairs_policy_and_egress_without_reboot_or_reprovision(self) -> None:
         vm = self.create_vm()
         del self.network.firewall.tables[vm.id]
         self.host.events.clear()
@@ -395,9 +395,34 @@ class LifecyclePortTests(LifecycleTestCase):
         self.assertNotIn("process.start", self.host.actions(vm.id))
         self.assertNotIn("process.terminate", self.host.actions(vm.id))
         self.assertNotIn("client.configure", self.host.actions(vm.id))
+        self.assertIn(("network.ensure_bridge", None), self.host.events)
+        self.assertLess(self.host.events.index(("firewall.apply", vm.id)),
+                        self.host.events.index(("network.ensure_bridge", None)))
         self.assertEqual(self.provision.call_count, 1)
         self.assertEqual(self.copy_disk.call_count, 1)
 
+    def test_live_start_rejects_changed_network_settings_before_repairing_network(self) -> None:
+        vm = self.create_vm()
+        self.service._settings = replace(self.settings, bridge="another-bridge")
+        before = self.settings.state_path.read_bytes()
+        self.host.events.clear()
+        with self.assertRaisesRegex(ConflictError, "retained network"):
+            self.service.start(vm.id)
+        self.assertEqual(self.settings.state_path.read_bytes(), before)
+        self.assertNotIn(("network.ensure_bridge", None), self.host.events)
+        self.assertNotIn("firewall.apply", self.host.actions(vm.id))
+
+    def test_live_start_can_retry_an_egress_setup_failure_with_the_same_process(self) -> None:
+        vm = self.create_vm()
+        self.host.failures["network.ensure_bridge", None] = UvmError("egress setup failed")
+        with self.assertRaisesRegex(UvmError, "egress setup failed"):
+            self.service.start(vm.id)
+        self.assertEqual(self.process.observe(self.store.get(vm.id)), "alive")
+        self.assertEqual(self.network.firewall.status(vm), "enforced")
+        self.assertEqual(self.service.start(vm.id).pid, vm.pid)
+        self.assertEqual(len(self.process.started), 1)
+        self.assertEqual(self.provision.call_count, 1)
+
 
 class LifecycleBulkTests(LifecycleTestCase):
     def test_all_bulk_actions_take_one_outer_lock_and_use_only_selected_ids(self) -> None: